HONG KONG MONETARY AUTHORITY 
F VE Se Ta EY BH Jay 


OVERSIGHT FRAMEWORK FOR 
THE HONG KONG TRADE REPOSITORY 


A Guideline issued by the Monetary Authority 


Purpose 

To explain the general requirements of the Monetary Authority in overseeing 
the Hong Kong Trade Repository. 

Classification 

A guideline issued by the Monetary Authority required to be complied with by 
the Hong Kong Trade Repository. 

Previous guidelines superseded 


This supersedes the version dated 20 May 2016. 


Application 


To the Hong Kong Trade Repository. 


Date: 13 July 2016 


The page is intentionally left blank. 


Contents 


Ay INTRODUCTION: Serpan a engl cae 1 
He, 10 1i 0a FS EE tastoves E A EE E E E E TE Rem eapaantaea vase ore aee 1 
OM + TSG KO POUT enix iis orethel eta d larch a Sabiri dani ec a T A leur tad Senna ea ehiet 1 
3. Roles of Different Departments within the HKMA 1.00.0... eee eeceeeseeeeeeteceseeneeeneeeneees 2 
Bis POLICY FRAMEWORK eaan lessened e NER E Ea TRATEN R AT NaS 4 
Ae. “Genèräl Poley nennir e atthe E E ER RAN A RE ERT a NS 4 
5. International Standards. ..ccduscesnecticntiqre sites. cqcuadherrapueenionnaesshad aheoomuaaneae 4 
C. OVERSIGHT REQUIREMENTS s:c)sica sacs upsnetaterse saspiycugngtons wasareseedissedy saieetooeed avian 6 
6.. - Introductions nsa naaa es athe chads dened aa a a aves dade aa eee 6 
7. Legal, Governance Framework and Risk Management Framework.................06 7 
$: Safety Requirements... ick achoceam airy ania n a a a a aa 12 
9. Efficiency and Effectiveness Requirements .0...........cccccescceesceesceceseceseceeeeeeseeeeeees 20 
10. System Links with other Financial Market Infrastructures .0........ cc eseeseereeeeeeeee 25 
11. Disclosure of Rules, Key Procedures and Market Data .0........cceceeseeseereeeeeeneeeees 27 
12. Disclosure of Market Data by the HKTR ....... eee cecceecceeceeneeceseceeeeeeeeeeseeenaeens 28 
D: “OVERSIGH E APPROACH snerist oniiir eiai hno AEE RE EATIS 29 
13. Jntroduyċtiom snositi ne e aae E AEKA EAE AAE AREKE 29 
14. Off-site Reviews and Continuous Monitoring...........ssssssssessessesseessesseesrosseeseesressee 30 
15; SOAS ILS RAIMA tion S 5, iee iera ioia aa i e i a a eria na 31 
16: Auditor s Reports nonner t an E Gives liane EE EEEE 32 
17. Meeting with the Management of the HKTR.......s.ssssessesessssseessssesseseesessessesseseesesse 32 
18. Co-operation with other authorities ..........sssssnssesessssesseseessressessresreeseesresseeseeseesseesse 33 
19: Follow-Up ACOS sinora a a a r R 33 
E+ OTHERS aereoa o E R E A A NA E S 33 
20; Miscellaneous inisinia tases aida E ae e a a E E a tated 34 
ANNER nerh: Meh aa a a a a a aa e a a a a eats Aura 35 


CPMI-IOSCO Principles for Financial Market Infrastructures: Principles applicable to 
Trade Repositories orriren aaa eiai ea aeaa Ea ESE ee 35 


A. INTRODUCTION 


1. 


1.1 


2. 


2.1 


2:2 


Purpose 


This document sets out the requirements for overseeing the over-the 
counter (“OTC”) derivatives trade repository established by the 
Monetary Authority (“MA”)! in Hong Kong within the MA’s 
organisation, the Hong Kong Monetary Authority (““HKMA”). 


Background 


The global financial crisis in 2008 triggered a global movement to 
improve transparency and reduce counterparty risks in the OTC 
derivatives markets, resulting in reforms to the OTC derivatives 
markets on various fronts. The reform measures adopted by the 
international regulatory community include requiring all OTC 


derivatives transactions to be reported to trade repositories. 


A trade repository (“TR”) is a centralised registry that maintains an 
electronic database of records of OTC derivatives transactions. By 
collecting and providing OTC derivatives transaction information to 
regulatory authorities, TRs play a vital role in supporting authorities to 
carry out their market surveillance responsibilities, which will help 
maintain financial stability. TRs also help improve market 
transparency, promote standardisation and ensure availability and 


quality of transaction data. 





1 


The office of the MA is known as the Hong Kong Monetary Authority (HKMA), and the MA is the 


Chief Executive of the HKMA. The MA is appointed under the Exchange Fund Ordinance to 
assist the Financial Secretary in performing his functions under the Exchange Fund Ordinance and 
to perform such other functions as are assigned by other Ordinances or by the Financial Secretary. 


2.3 


2.4 


2.5 


2.6 


3. 


3.1 


In response to the G20’s commitment to improve the transparency and 
regulatory oversight of OTC derivatives markets, the MA, the 
Securities and Futures Commission (“SFC”) and other stakeholders in 
Hong Kong have established a regulatory regime for OTC derivatives 
markets under the Securities and Futures Ordinance (Chapter 571 of the 
Laws of Hong Kong) (“SFO”), including a reporting obligation for 
prescribed persons? to report OTC derivatives transactions to which 
section 101B(2) of the SFO applies to a TR established by the HKMA, 
namely the HKTR. 


The HKTR plays an important role in maintaining financial stability. 
The safety and efficiency of the HKTR will enable its users to report 
OTC derivatives transactions to which section 101B(2) of the SFO 
applies in a timely and convenient manner in accordance with the 
reporting rules’. The OTC derivatives transaction data available from 
the HKTR will also help enhance market transparency and improve 


market surveillance. 


The oversight requirements and arrangements for the HKTR set out in 
this Guideline may be fine-tuned and revised from time to time in the 
light of the developments in international OTC derivatives markets and 


experience to be gained in this regard. 


Unless otherwise specified, the terms used in this Guideline follow 
those used in the Principles for Financial Market Infrastructures (see 


paragraph 5.1 for details). 


Roles of Different Departments within the HKMA 


To ensure effective operation and oversight of the HKTR, two different 


2? As defined in section 101A of the SFO. 
3 As defined in section 101A of the SFO. 


3.2 


3.3 


departments of the HKMA undertake the operational and oversight 
roles respectively. The Trade Repository team of the Financial 
Infrastructure Department (“TR team”) is responsible for the 
development and operation of the HKTR. The Financial Market 
Infrastructure Oversight team of the Banking Conduct Department 
(“FMIO team”) is responsible for the oversight of the HKTR. In order 
to avoid any potential or actual conflicts of interest, there are effective 
“Chinese wall” arrangements between the TR and FMIO teams. In 
particular, the two teams belong to two different departments of the 
HKMA and have separate reporting lines to different senior executives 


of the HKMA. 


The FMIO team applies the same procedures and standards, where 
relevant, in overseeing the HKTR as it does in overseeing other FMIs, 
whether operated by the HKMA or other parties. All information 
obtained by the FMIO team arising from its oversight of the HKTR is 


kept strictly confidential and solely used for oversight purposes. 


The oversight by the FMIO team focuses on the core function of the 
HKTR (i.e., the reporting service which was launched in July 2013). 
Ancillary functions performed by the HKTR (e.g., matching and 
confirmation services) will be subject to oversight by the FMIO team to 
the extent that performance of the ancillary functions may affect 
performance of the core function. Under the current system design of 
the HKTR, the reporting service under the core function and the other 
services under the ancillary functions are offered separately and trade 
data submitted to the HKTR for one purpose cannot be used for the 
other purpose. 


B. POLICY FRAMEWORK 


4. 


4.1 


5. 


General Policy 


One of the functions of the MA is to maintain the stability and integrity 
of the monetary and financial systems of Hong Kong, including the 
maintenance and development of Hong Kong’s financial infrastructure 
such as the HKTR. Therefore, the MA shall ensure that the HKTR is 


operated in a safe and efficient manner. 


International Standards 


Principles for Financial Market Infrastructures 


5.1 


5.2 


The Committee on Payments and Market Infrastructures of the Bank 
for International Settlements (“CPMI”) and the International 
Organization of Securities Commissions (“IOSCO”) published a joint 
report “Principles for Financial Market Infrastructures” (“PFMP’) in 
April 2012. The PFMI update, harmonise and strengthen the risk 
management and related standards applicable to financial market 
infrastructures (“FMIs”) which include systemically important 
payment systems, central securities depositories, securities settlement 
systems, central counterparties and trade repositories. The PFMI 


principles applicable to a TR are set out in the Annex. 


Paragraph 1.23 of the PFMI states that, in general, the PFMI are 
applicable to FMIs that operated by central banks and those operated 
by the private sector, but recognises that there are exceptional cases 
where the PFMI are applied differently to central bank-operated FMIs 
due to requirements in relevant law, regulation or policy. The CPMI 


and IOSCO issued a short note “Application of Principles for financial 


market infrastructures to central bank FMIs”* in August 2015 to 
elaborate this point. The note provides guidance on how the PFMI 
apply to FMIs that are owned and operated by central banks, and 
further clarifies the interaction between the PFMI and central bank 


policies. 


5.3 The HKMA has committed to comply with the international regulatory 
standards on overseeing FMIs, including TRs. On 28 March 2013, 
the HKMA announced its policy intention to adopt the PFMI, and the 
PFMI (including the twenty-four principles and the five responsibilities) 


came into effect on the same day. 


5.4 The HKMA applies the same PFMI requirements to the FMIs 
(including the HKTR) under its purview. However, as noted in 
paragraph 5.2, there are exceptional cases where certain PFMI 
principles are applied differently to the FMIs owned and operated by 
the HKMA due to requirements in relevant law, regulation, or policy. 
The HKTR is one of the FMIs owned and operated by the HKMA. 
The exceptional cases relevant to the HKTR where the PFMI principles 
may be applied differently are: 


1) since the HKTR is operated as an internal function of the 
HKMA, the requirements in paragraphs 7.3.3 and 7.3.4 on 
governance are not intended to constrain the composition of the 
HKMA’s governing body or that body’s roles and 


responsibilities. 


il) since the HKMA owns and operates the HKTR as one of the 
services which the HKMA has undertaken to provide, the 
HKMA’s ability to ensure continuity of operations of the HKTR 


* The note is available on the BIS website: http://www.bis.org/cpmi/publ/d130.pdf 


iii) 


iv) 


as necessary in extreme financial circumstances means that the 
requirements to prepare recovery and orderly wind-down plans 
do not apply; however, if the HKMA were to decide to 
terminate the service, it should seek to do so in a transparent and 
orderly manner. In addition, since intervention by a resolution 
authority is not relevant, requirements in paragraph 7.4.5 to 
support resolution planning or intervention by a resolution 


authority in the operation or ownership of the HKTR do not 
apply. 


the requirement in paragraphs 8.1.3 to 8.1.5 to hold ring-fenced 
liquid net assets funded by equity to cover business risk and 
support a recovery or wind-down plan does not apply to the 
HKTR since it is owned and operated by the HKMA and given 
the HKMA’s inherent financial soundness. Similarly, the 
requirement in paragraph 8.1.6 to maintain a plan to raise 


additional equity does not apply. 


regardless of the form of any involvement of the HKMA in 
FMIs, nothing in this Guideline is intended to constrain the 
HKMA’s policies on to whom it is prepared to offer accounts 
and on what terms (cf paragraphs 9.5.1 to 9.5.3) or its choices 


on implementation of monetary policy. 


C. OVERSIGHT REQUIREMENTS 


6. 


6.1 


Introduction 


In line 


with the policy objectives of the CPMI and IOSCO, the policy 


6.2 


7. 


7.1 


objectives for Hong Kong’s FMIs, including TRs, are to enhance safety 
and efficiency in payment, clearing, settlement and recording 
arrangements, and more broadly, to limit systemic risk and foster 
transparency and stability of the financial system. The primary public 
policy benefits provided by a TR, which stem from the centralisation 
and quality of the data that a TR maintains, are improved market 
transparency and provision of data to relevant authorities and the public 
according to their respective information needs. Timely and reliable 
access to the data stored in a TR could potentially improve significantly 
the ability of relevant authorities and the public to identify and evaluate 


the potential risks posed to the broader financial system. 


Apart from the safety and efficiency requirements, one of the primary 
focuses of the oversight of the HKTR is whether the HKTR is able to 
provide data in line with the regulatory and industry expectations to 
relevant authorities and the public, and whether the data is provided in a 
timely manner and in a format that permits the data to be easily 


analysed. 


Legal, Governance Framework and Risk Management Framework 


A sound legal framework, a proper governance structure and a 
comprehensive risk management framework are important elements in 
establishing a strong foundation for the effective and efficient 


management of the HKTR. 


Legal basis 


7.2 


The HKTR should have a well-founded, clear, transparent, and 
enforceable legal basis for each material aspect of its activities in all 
relevant jurisdictions. The legal basis consists of the legal framework 


and the relevant rules, procedures and legal arrangements between the 


parties. 


7.2.1 


Leek 


7.2.3 


7.2.4 


125 


The HKTR should have rules, procedures, and contracts 
that are clear, understandable, enforceable and consistent 


with the relevant laws and regulations. 


The legal basis of the HKTR should provide a high degree 
of certainty for each material aspect of its activities in all 


relevant jurisdictions. 


a) The legal basis of the HKTR should specifically define 
the rights and interests of its participants and other 
relevant stakeholders with respect to the data records 
stored in the HKTR. The legal basis of the HKTR 
should also determine the rules and procedures for 
providing access and disclosing data to its participants, 
relevant authorities and the public to meet their 
respective information needs, as well as data protection 


and confidentiality issues. 


The HKTR should be able to articulate the legal basis for its 
activities to relevant authorities, participants, and, where 
relevant, participants’ customers, in a clear and 


understandable way. 


The HKTR should have rules, procedures, and contracts 
that are enforceable in all relevant jurisdictions. There 
should be a high degree of certainty that actions taken by 
the HKTR under such rules and procedures will not be 


voided, reversed, or subject to stays. 


Where the HKTR conducts businesses in multiple 


jurisdictions, it should identify and mitigate the risks arising 


Governance 


from any potential conflict of laws across jurisdictions. 


7.3 The HKTR should have governance arrangements that are clear and 


transparent, promote the safety and efficiency of the HKTR, and support 


the stability of the broader financial system, other relevant public 


interest considerations, and the objectives of relevant stakeholders. 


7.3.1 


Toe 


7.3.3 


7.3.4 


The HKTR should have objectives that place a high priority 
on the safety and efficiency of the HKTR, and explicitly 
support financial stability and other relevant public interest 


considerations. 


The HKTR should have documented governance 
arrangements that provide clear and direct lines of 
responsibility and accountability. These arrangements 
should be disclosed to owners, relevant authorities, 


participants, and, at a more general level, the public. 


The roles and responsibilities of the HKTR’s board of 
directors (or equivalent) should be clearly specified, and 
there should be documented procedures for its functioning, 
including procedures to identify, address, and manage 
member conflicts of interest. The board (or equivalent) 
should review both its overall performance and the 
performance of its individual board members regularly. 
See paragraph 5.4 for the application of this requirement to 


the HKTR. 


The board (or equivalent) should contain suitable members 
with the appropriate skills and incentives to fulfil its 


multiple roles. This typically requires the inclusion of 


non-executive board member(s). See paragraph 5.4 for the 


application of this requirement to the HKTR. 


7.3.5 The roles and responsibilities of the management of the 
HKTR should be clearly specified. The HKTR’s 
management should have the appropriate experience, a mix 
of skills, and the integrity necessary to discharge their 
responsibilities for the operation and risk management of 


the HKTR. 


7.3.6 The board (or equivalent) should establish a clear, 
documented risk-management framework that includes the 
HKTR’s risk-tolerance policy, assigns responsibilities and 
accountability for risk decisions, and addresses decision 
making in crises and emergencies. Governance 
arrangements should ensure that the risk-management and 
internal control functions have sufficient authority, 
independence, resources, and access to the board (or 


equivalent). 


7.3.7 The board (or equivalent) should ensure that HKTR’s 
design, rules, overall strategy, and major decisions should 
reflect appropriately the legitimate interests of its direct and 
indirect participants and other relevant stakeholders. 
Major decisions should be clearly disclosed to relevant 
stakeholders and, where there is a broad market impact, the 


public. 


Framework for the comprehensive management of risks 


7.4 The HKTR should have a sound risk management framework for 


comprehensively managing legal, operational and other risks. 
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7.4.1 


7.4.2 


7.4.3 


7.4.4 


7.4.5 


The HKTR should have risk management policies, 
procedures and systems that enable it to identify, measure, 
monitor and manage the range of risks that arise in or are 
borne by the HKTR. Risk management frameworks 


should be subject to periodic review. 


The rules and procedures of the HKTR play a key role in 
enabling its participants to understand the risks involved in 
participating in the HKTR. Therefore, the rules and 
procedures of the HKTR should be written in a clear and 
comprehensive manner so as to facilitate understanding by 
its participants of the risks that they may encounter through 


participating in the system. 


The HKTR should provide incentives to its participants and, 
where relevant, their customers, to manage and contain the 


risks they pose to the HKTR. 


The HKTR should regularly review the material risks it 
bears from and poses to other entities (such as other FMIs 
and service providers) as a result of interdependencies, and 
develop appropriate risk management tools to address these 


risks. 


The HKTR should identify scenarios that may potentially 
prevent it from being able to provide its critical operations 
and services as a going concern and assess the effectiveness 
of a full range of options for recovery or orderly wind-down. 
The HKTR should prepare appropriate plans for its 
recovery or orderly wind-down based on the results of that 


assessment. Where applicable, the HKTR should also 
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8. 


General business risk 


8.1 


provide relevant authorities with the information needed for 
purposes of resolution planning. See paragraph 5.4 for the 


application of this requirement to the HKTR. 


Safety Requirements 


The HKTR should identify, monitor, and manage its general business 


risk and hold sufficient liquid net assets funded by equity to cover 


potential general business losses so that it can continue operations and 


services as a going concern if those losses materialise. The HKTR 


faces general business and operational risks, which may affect its 


reliability and robustness. The inability of the HKTR to continue its 


operations could have systemic risk implications for its participants and 


the broader financial markets. 


8.1.1 


8.1.2 


The HKTR should have robust management and control 
systems to identify, monitor and manage general business 
risks, including losses from poor execution of business 
strategy, negative cash flows or unexpected and excessively 


large operating expenses. 


The HKTR should ensure there are sufficient resources 
(such as manpower, financial and information technology 
(IT)) to support system performance, including both 


day-to-day operations and system development. 


The HKTR should hold liquid net assets funded by equity 


(such as common stock, disclosed reserves, or other 
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retained earnings)? so that it can continue operations and 
services as a going concern if it incurs general business 
losses. The amount of liquid net assets funded by equity the 
HKTR should hold should be determined by its general 
business risk profile and the length of time required to 
achieve a recovery or orderly wind-down, as appropriate, of 
its critical operations and services if such action is taken. 
See paragraph 5.4 for the application of this requirement to 


the HKTR. 


8.1.4 The HKTR should maintain a viable recovery or orderly 
wind-down plan and should hold sufficient liquid net assets 
funded by equity to implement this plan. At a minimum, 
the HKTR should hold liquid net assets funded by equity 
equal to at least six months of current operating expenses. 
These assets are in addition to resources held to cover 
participant defaults or other risks covered under the 
financial resources principles. However, equity held under 
international risk-based capital standards can be included 
where relevant and appropriate to avoid duplicate capital 
requirements. See paragraph 5.4 for the application of this 


requirement to the HKTR. 


8.1.5 Assets held to cover general business risk should be of high 
quality and sufficiently liquid in order to allow the HKTR 
to meet its current and projected operating expenses under a 
range of scenarios, including in adverse market conditions. 
See paragraph 5.4 for the application of this requirement to 


the HKTR. 


5 According to the PFMI, if the FMI’s corporate structure is such that it cannot legally or institutionally 
raise equity (for example under certain structures of mutual ownership or when the FMI is run by a 
central bank) or if the FMI is a new start-up and cannot initially raise the required level of equity, it 
should ensure an equal amount of equivalent loss absorbing financial resources is available. 
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8.2 


8.1.6 The HKTR should maintain a viable plan for raising 
additional equity should its equity fall close to or below the 
amount needed. This plan should be approved by the 
board of directors and updated regularly. See paragraph 
5.4 for the application of this requirement to the HKTR. 


Control of access, physical security and information integrity 


Access control 


8.2.1 The HKTR should ensure the safety of the system by 


controlling access to its operations. Such controls should 


be secure and robust, with security reviewed and tested 


periodically. 
Physical security 
8.2.2 The HKTR should have comprehensive physical security 


policies that address all potential vulnerabilities and threats. 
In particular, the HKTR should have effective policies for 
assessing and mitigating vulnerabilities in its physical sites 


from attacks, intrusions and natural disasters. 


Information security and integrity 


8.2.3 The security and integrity of information held within the 
HKTR is a key safety requirement. The data should be 
protected from loss, leakage, unauthorised access and other 
processing risks caused by human input errors, negligence, 


fraud, poor administration and inadequate record-keeping. 
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8.2.4 


8.2.5 


a) 


b) 


c) 


The HKTR should have sound and robust information 
security policies, standards, practices and controls to 
identify, assess and manage security threats and 
vulnerabilities and implement appropriate safeguards. The 
information security objectives and policies should conform 
to established industry standards for confidentiality, 
integrity, authentication, authorisation, non-repudiation, 


availability and auditability. 
The integrity and confidentiality of data should be ensured 
by means of suitable measures and effective controls 


including: 


adequate back-up of all data and information (real-time 


back-up is expected for important or key information); 


mechanisms for storage and avoiding leakage to third 


parties; 


mechanisms to minimise human input errors; and 


d) both physical and logical access controls. 


8.3 Outsourcing 


8.3.1 


In case there is a need for outsourcing arrangements for 
certain areas of the operations of the HKTR, operational 
reliability, information integrity, security procedures and 
business continuity plan (BCP) should extend to such 
outsourced areas or processes and the relevant service 
providers. Therefore, the proposed outsourcing 


arrangements should be subject to a comprehensive risk 
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8.4 


a) 

b) 

c) 
8.3.2 
Personnel 
8.4.1 


assessment and all the risks identified should be adequately 
addressed before the plans are implemented. The risk 


assessment should cover, inter alia, the following: 


the importance and criticality of the services to be 


outsourced; 


reasons for the outsourcing (e.g., cost and benefit 


analysis); and 


the impact on the system’s risk profile of the outsourcing. 


Even when any operations or processes of the HKTR are 
outsourced, the HKTR remains responsible for such 
outsourced operations and processes and for ensuring that 
the requirements under this oversight framework are 


complied with. 


To ensure the safety and reliability of the HKTR, personnel 
engaged in the operation of the system should possess 
levels of knowledge, qualification and experience 
appropriate for their duties and responsibilities and be 
well-trained and competent. The staff responsible for 
technical support of the system components should be 
available when needed (including out of normal business 
hours) to correct errors and resolve problems. They 
should be subject to stringent internal controls including 
arrangements to identify and avoid potential conflicts of 


interest. 
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8.5 


8.6 


Operational risk 


The HKTR should identify the plausible sources of operational risk, both 


internal and external, and mitigate their impact through the use of 


appropriate systems, policies, procedures, and controls. Systems 


should be designed to ensure a high degree of security and operational 


reliability and should have adequate, scalable capacity. Business 


continuity management should aim for timely recovery of operations and 


fulfilment of the HKTR’s obligations, including in the event of a 


wide-scale or major disruption. 


8.6.1 


8.6.2 


8.6.3 


8.6.4 


The HKTR should establish a robust operational risk 
management framework with appropriate systems, policies, 
procedures and controls to identify, monitor and manage 


operational risks. 


The HKTR’s board of directors (or equivalent) should 
clearly define the roles and responsibilities for addressing 
operational risk and should endorse HKTR’s operational 
risk-management framework. Systems, operational 
policies, procedures, and controls should be reviewed, 
audited, and tested periodically and after significant 


changes. 


The HKTR should have clearly defined operational 
reliability objectives and should have policies in place that 


are designed to achieve those objectives. 
The HKTR should have comprehensive physical and 


information security policies that address all potential 


vulnerabilities and threats. 
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System capacity 


8.6.5 


The HKTR should ensure that it has scalable capacity 
adequate to handle increasing stress volumes and to achieve 


its service-level objectives. 


Business continuity plan 


8.6.6 


The HKTR should have a BCP that addresses events posing 
a significant risk of disrupting operations, including events 
that could cause a wide-scale or major disruption. The 
plan should incorporate the use of a secondary site and 
should be designed to ensure that critical IT systems can 
resume operations within two hours following disruptive 
events. The HKTR should regularly test these arrangements. 
This requires the HKTR, among other things: 


a) to have detailed contingency plans, including back-up 
arrangements for its crucial communications and 
computer systems and key personnel. The 


contingency plans should have the following elements: 


i) clearly stated objectives (including recovery time 
and recovery points), policies and procedures that 
allow for the rapid recovery and timely 
resumption of critical operations following a 


disruption to a service; 


ii) identification of events that pose a significant risk 
of disrupting operations, including events that 
could cause a wide-scale or major disruption to 


the operations of the system, and establishing 
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measures to address such events; and 


iii) clearly defined procedures for crisis and event 
management, including procedures to deal with 
potential data loss and timely and effective 
communication strategies to consult with and 
inform its participants, interdependent FMIs, 
regulators and others (e.g., critical service 


providers) and, where relevant, the media; 


b) to set up a secondary site with sufficient resources, 
capabilities, functionalities and appropriate staffing 
arrangements that would not be affected by a 
wide-scale or major disruption to the operations of the 
HKTR at the primary site and would allow the 
secondary site to take over the operations at the primary 


site if needed; 


c) to undertake testing of its business recovery 
arrangements regularly. Tests should include 
scenarios that simulate wide-scale and major 
disruptions to the operations at the primary site and 
inter-site switch-overs. System participants, critical 
service providers and interdependent FMIs, where 
appropriate and to the extent possible, should be 


involved in the testing; and 

d) to conduct regular reviews of the adequacy of these 
arrangements and make such modifications as are 
necessary. 


8.6.7 The HKTR should identify, monitor, and manage the risks 
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9. 


9.1 


9.2 


that key participants, other FMIs, and service and utility 
providers might pose to its operations. In addition, the 
HKTR should identify, monitor, and manage the risks its 


operations might pose to other FMIs. 


Efficiency and Effectiveness Requirements 


The HKTR should be efficient and effective in meeting the 


requirements of its participants and the markets it serves. 


9.1.1 


The HKTR should be designed to meet the needs of its 
participants and the markets it serves, in particular, with 
regard to choice of operating structure; scope of products 


recorded; and use of technology and procedures. 


The HKTR should have clearly defined goals and objectives 
that are measureable and achievable, such as in the areas of 
minimum service levels, risk management expectations and 


business priorities. 


The HKTR should have established mechanisms for the 


regular review of its efficiency and effectiveness. 


System efficiency 


9.2.1 


9.2.2 


As mentioned above, the HKTR should be designed and 
operated to meet the needs of its participants and the markets 
it serves. Therefore, the technical arrangements of the 
system should be sufficiently flexible to respond to changing 


demands and new technologies. 


The efficiency of the HKTR will ultimately affect the use of 
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9.3 


9.4 


9.2.3 


the system by its participants and their customers as well as 
these entities’ ability to conduct robust risk management, 


which may affect the broader efficiency of financial markets. 


In promoting system efficiency, the HKTR should consider 
the practicality and costs for its participants and other 
relevant parties (e.g., linked FMIs), and ensure that the 
actual performance of the system meets the standards as 
stated in the system specifications and the relevant service 


agreements. 


Speed and efficiency of operations 


9.3.1 The HKTR should ensure that its operations are carried out 
with efficiency. In particular, the following conditions 
should be fulfilled: 

a) the HKTR should ensure that its system can process the 
transaction data at the required speed, including at peak 
times or on peak days. It should also plan for changes 
in volumes or business patterns so that the required 
speed can be maintained; and 

b) the system should seek to economise on costs by 
establishing mechanisms for the regular review of its 
efficiency, including its costs and pricing structure. 
Cost considerations, however, should always be 
balanced against the safety requirements of the system. 

Effectiveness 

9.4.1 The goals and objectives of the HKTR should include 
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9.4.2 


9.4.3 


9.4.4 


timeliness and accuracy. The HKTR should promptly 
record the transaction information it receives from its 


participants. 


The HKTR should employ efficient recordkeeping 
procedures to document changes to recorded transaction 
information resulting from subsequent post-trade events. 
The HKTR should ideally set a service-level target to record 
transaction information it receives from participants in real 


time, and at a minimum, within one business day. 


The HKTR should have adequate procedures and timelines 
for making data available for any downstream processing and 
should implement quality controls to ensure the accuracy, 


validity and integrity of the data it stores and disseminates. 


The HKTR should have effective processes and procedures 


for the provision of data to relevant authorities. 


Access and participation requirements 


9.5 


The HKTR should have objective, risk-based, and publicly disclosed 


criteria for participation, which permit fair and open access. 


9.5.1 


9.5.2 


The HKTR should allow for fair and open access to its 
services, including by direct and, where relevant, indirect 
participants and other FMIs, based on reasonable risk-related 
participation requirements. See paragraph 5.4 for the 


application of this requirement to the HKTR. 


The HKTR’s participation requirements should be justified in 
terms of the safety and efficiency of the HKTR and the 
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markets it serves, be tailored to and commensurate with the 
HKTR’s specific risks, and be publicly disclosed. Subject 
to maintaining acceptable risk control standards, the HKTR 
should endeavour to set requirements that have the least 
restrictive impact on access that circumstances permit. See 
paragraph 5.4 for the application of this requirement to the 
HKTR. 


The HKTR should monitor compliance with its participation 
requirements on an ongoing basis and have clearly defined 
and publicly disclosed procedures for facilitating the 
suspension or orderly exit of a participant that breaches, or 
no longer meets, the participation requirements. See 
paragraph 5.4 for the application of this requirement to the 
HKTR. 


9.6 Cost of participation 


9.6.1 


9.6.2 


The HKTR should ensure efficiency by keeping the overall 
cost to a participant of its participation in the system 
reasonable, having regard to the services provided by the 


HKTR to the participants. 


Generally speaking, the cost of participation in the HKTR 


comprises two components: 


a) System service fees and charges — which can be 


affected by the processing costs of the system; and 
b) Participants’ internal processing costs — which are 
external to the system but can be influenced by the 


system design. 
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9.6.3 


The internal processing costs of participants of the HKTR 
may include the costs of preparing instructions capable of 
being accepted by the system, transmitting and receiving 
system messages and internal processing borne by the 
participants. While the HKTR cannot control these costs 
directly, it needs to be aware of how the system design, as 
well as technology and procedures adopted by the system, 


might affect these costs. 


Tiered participation arrangements 


9.7 The HKTR should identify, monitor, and manage the material risks to 


the HKTR arising from tiered participation arrangements. 


9.7.1 


9.7.2 


9.7.3 


9.7.4 


The HKTR should ensure that its rules, procedures, and 
agreements allow it to gather basic information about 
indirect participation in order to identify, monitor, and 
manage any material risks to the HKTR arising from such 


tiered participation arrangements. 


The HKTR should identify material dependencies between 
direct and indirect participants that might affect the HKTR. 


The HKTR should identify indirect participants responsible 
for a significant proportion of transaction data processed by 
the HKTR and indirect participants whose transaction data 
volumes or values are large relative to the capacity of the 
direct participants through which they access the HKTR in 


order to manage the risks arising from such transaction data. 


The HKTR should regularly review risks arising from tiered 
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participation arrangements and should take mitigating action 


when appropriate. 


Communication procedures and standards 


9.8 The communication procedures and standards are particularly 
important for a TR as it serves as a data centre for a variety of 
stakeholders potentially located in many jurisdictions. The HKTR 
should use, or at a minimum accommodate, relevant internationally 
accepted communication procedures and standards in order to facilitate 


efficient recording. 


9.8.1 In particular, the HKTR should use, or at a minimum 
accommodate, internationally accepted communication 


procedures and standards. 


a) The HKTR should support technologies that are widely 
accepted in the market, including applicable market 


standards for reporting and recording trade information. 


b) Where appropriate, the HKTR should adopt industry 
standards for data representation, including those 
related to the unique identification of counterparties 
(such as legal entity identifiers) to facilitate the use and 
aggregation of data stored in the repository, especially 


by authorities. 


10. System Links with other Financial Market Infrastructures 


10.1 Where the HKTR establishes a link with one or more FMIs, it should 


identify, monitor, and manage link-related risks. 
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10.1.1 


10.1.2 


10.1.3 


Before entering into a link arrangement and on an ongoing 
basis once the link is established, the HKTR should identify, 
monitor and manage all potential sources of risks arising 
from the link arrangement. Link arrangements should be 
designed such that each FMI is able to observe the other 


requirements in this Guideline where applicable. 


The links should have a well-founded legal basis, in all 
relevant jurisdictions, that supports their design and provides 
adequate protection to the FMIs involved in the link. For 
links that are cross-border, legal risks may arise from 
differences in applicable laws and rules governing the linked 
FMIs and their participants in different jurisdictions. To 
limit these uncertainties, the respective rights and 
obligations of the linked FMIs and, where necessary, their 
participants should be clearly set out in the link agreement. 
The link agreement should also set out, in 
cross-jurisdictional context, an unambiguous choice of law 


that will govern each aspect of the link. 


The HKTR should carefully assess the additional operational 
risks related to its links to other FMIs to ensure the 
scalability and reliability of IT and related resources. The 
linked FMIs should provide an appropriate level of 
information about their operations to each other in order for 
each of the FMIs involved to perform effective periodic 
assessments of the operational risks associated with the link. 
In particular, the FMIs should ensure that risk management 
arrangements and processing capacity are sufficiently 
scalable and reliable to operate the link safely for both the 
current and projected peak volumes of activities processed 


over the link. Arrangements between the linked FMIs 
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should also be reliable and secure so that the link does not 
pose significant operational risk to the linked FMIs. Any 
reliance by a linked FMI on a critical service provider 
should be disclosed as appropriate to the other FMI. In 
addition, a linked FMI should identify, monitor and manage 
operational risks due to complexities or inefficiencies 
associated with different time zones as these may have 


significant resource implications (e.g., staff availability). 


11. Disclosure of Rules, Key Procedures and Market Data 


11.1 


The HKTR should have clear and comprehensive rules and procedures 


and should provide sufficient information to enable participants to have 


an accurate understanding of the risks, fees, and other material costs 


they incur by participating in the HKTR. All relevant rules and key 


procedures should be publicly disclosed. 


11.1.1 


11.1.2 


11.1.3 


11.1.4 


The HKTR should adopt clear and comprehensive rules and 
procedures that are fully disclosed to participants. Relevant 


rules and key procedures should also be publicly disclosed. 


The HKTR should disclose clear descriptions of the system’s 
design and operations and the rights and obligations of the 
HKTR and the participants so that the participants can assess 
the risks they would incur when participating in the HKTR. 


The HKTR should provide all necessary and appropriate 
documentation and training to facilitate its participants’ 
understanding of its rules and procedures and the risks they 


face from participating in the HKTR. 


The HKTR should publicly disclose its fees at the level of 


27 


individual services it offers as well as its policies on pricing 
structure, including any available discounts. The HKTR 
should provide clear descriptions of priced services for 


comparability purposes. 


11.1.5 The HKTR should complete regularly and disclose publicly 
responses to the CPMI-IOSCO Disclosure Framework for 
financial market infrastructures. The HKTR also should, at 
a minimum, disclose basic data on transaction volumes and 


values. 


12. Disclosure of Market Data by the HKTR 


12.1 


The HKTR should provide timely and accurate data to relevant 


authorities and the public in line with their respective needs. 


12.1.1 The HKTR should provide data in line with the regulatory 
and industry expectations to relevant authorities and the 
public, respectively, that is comprehensive and at a level of 
detail sufficient to enhance market transparency and support 


other public policy objectives. 


12.1.2 The HKTR should have effective processes and procedures 
to provide data to relevant authorities in a timely and 
appropriate manner to enable them to meet their regulatory 
mandates and legal responsibilities. The provision of data 
by the HKTR to the relevant authorities should be supported 
from a legal, procedural, operational and technological 


perspective. 


12.1.3 The HKTR should also be able to provide different scopes 


and levels of data depending on the respective information 
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12.1.4 


needs of the relevant authorities and in accordance with 
applicable laws and regulations. Subject to the applicable 
laws and regulations, relevant authorities may have access to 
additional data kept by the HKTR, including 
participant-level data, which is relevant to their respective 
regulatory mandates and legal responsibilities which may 
include market regulation and surveillance, oversight of 
market infrastructures, prudential supervision, resolution of 


failed institutions and systemic risk regulation. 


The HKTR should have robust information systems that 
provide accurate current and historical data. The HKTR 
should collect, store, and provide data to its participants, 
authorities, and the public in a timely manner and in a 


format that permits the data to be easily analysed. 


a) The HKTR should make the data and other relevant 
information it discloses publicly readily available 
through generally accessible media, such as the Internet, 
in a language commonly used in financial markets. 
The data should be accompanied by robust explanatory 
documentation that enables users to understand and 


interpret the data correctly. 


D. OVERSIGHT APPROACH 


13. Introduction 


13.1 The objective of the oversight is to provide an effective process to 


monitor and assess the compliance of the HKTR with the requirements 
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13.2 


as stipulated in this oversight framework. The process follows a 
risk-based approach. This involves on-going monitoring of the 
compliance of the HKTR with a focus on areas of high risks using a 


variety of techniques aimed at detecting problems at an early stage. 


The oversight of the HK TR is conducted through the following means: 


13.2.1 off-site reviews and continuous monitoring; 

13.2.2 on-site examinations; 

13.2.3 auditor’s reports; 

13.2.4 meeting with the management of the TR team; 

13.2.5 co-operation with other authorities where relevant; and 


13.2.6 follow-up actions. 


14. Off-site Reviews and Continuous Monitoring 


14.1 


14.2 


These form the core of the oversight approach for the HKTR. The 
reviews enable the FMIO team to evaluate the degree of compliance of 
the HKTR with the requirements as stipulated in this oversight 
framework. Information is collected, on a regular basis, on transaction 
volumes, system performance statistics, incidents of default, 
non-compliance with the requirements as stipulated in this oversight 
framework and significant events in the coming months which may 


have risk implications for the HKTR. 


In addition, the FMIO team may require the HKTR to provide 
supplementary information, on a timely basis, for off-site reviews and 
other analyses. The information may include confidential and 
non-public information such as the functions, activities, the BCPs and 
the overall financial condition of the HKTR and periodic auditor’s 


reports on various risk areas. 
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14.3 


In addition to regular submission of returns, the HKTR should report to 
the FMIO team any delays or abnormal events as soon as possible. 
This should be followed by a written report to the FMIO team within a 
reasonable time specified by the FMIO team, explaining the cause and 
impact of the event and the remedial action taken or to be taken. The 
HKTR should inform the FMIO team as early as possible if it has 
difficulty in submitting the report within the specified time. The 
FMIO team may also require the HKTR to provide relevant information 


which may be useful for the FMIO team to understand and assess: 


a) the risks borne or created by the HKTR and, where appropriate, its 


participants; 


b) the HKTR’s impact on its participants and the broader economy; 


and 


c) the HKTR’s adherence to the relevant laws, regulations and 


policies. 


15. On-site Examinations 


15.1 


15.2 


On-site examinations complement the FMIO team’s off-site reviews 
and provide it with the opportunity to assess at first-hand how HKTR is 
being operated, managed and controlled. On-site examinations will be 
conducted when necessary. In general, the scope of an on-site 
examination will focus on priority areas identified through the off-site 
review process that either presents high-risk areas or where control 


process validations are needed. 


The FMIO team will discuss the main findings of the examination with 
the HKTR and will consider its comments/feedback before issuing a 


formal report. An on-site examination report, which will identify any 
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area of weakness or concern and make recommendations for remedial 
action, will be issued to the HKTR. The frequency of on-site 


examination varies and will be conducted on a need basis. 


16. Auditor’s Reports 


16.1 


16.2 


To supplement off-site reviews and on-site examinations, the FMIO 
team may request the HKTR to submit an auditor’s report on high-risk 
areas or other areas of concern to assist the FMIO team in deciding 
whether the HKTR complies with the requirements as stipulated in this 


oversight framework. 


If considered necessary, the FMIO team may hold a tripartite meeting 
with the auditor and the appropriate management personnel of the 


HKTR to discuss matters arising from the auditor’s report. 


17. Meeting with the Management of the HKTR 


17.1 


17.2 


As part of the continuous oversight process, the FMIO team will hold 
an annual meeting with the appropriate management personnel of the 
HKTR. The purpose of the meeting is to discuss the findings of 
off-site reviews (and on-site examinations if such examinations have 
been conducted during the year), and particularly any significant 
deficiencies identified or any other matters of concern or mutual 
interest. The meeting also enables the FMIO team to better 
understand how the HKTR views and controls risks and how the HKTR 


assesses the business situation and future development. 
The FMIO team will prepare a report to the HKTR, summarising the 
discussion, any agreement reached and any follow-up actions required. 


Apart from the annual meeting, the FMIO team will meet with the 
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management of the HKTR to discuss issues of concern at such other 


times as considered necessary. 


18. Co-operation with other authorities 


18.1 Where necessary, the HKMA will co-operate with other authorities in 
overseeing the links established between the HKTR and other FMIs. 
Appropriate co-operative oversight frameworks will be established to 


assist the relevant authorities in discharging their oversight functions. 


19. Follow-up Actions 


19.1 When evaluating the compliance of the HKTR with the oversight 
requirements, the FMIO team may make recommendations to the 
HKTR, asking it to take steps to meet the oversight requirements where 
appropriate. On receipt of such recommendations, the HKTR is 
required to make changes or take corrective actions as soon as 
practicable to ensure that the relevant requirements are met. The 
FMIO team will closely monitor the implementation of the 


recommendations or the required actions by the HKTR. 
19.2 To preserve confidentiality, oversight information obtained from the 
HKTR during the course of oversight is subject to official secrecy and 


may not be disclosed to third parties except as permitted under 


applicable laws, rules and regulations. 


E. OTHERS 
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20. Miscellaneous 


20.1 It should be noted that although the FMIO team is responsible for 
overseeing the HKTR, the primary responsibility for day-to-day 
operational aspects of the HKTR rests with the HKTR. The FMIO 
team does not get involved in the daily operations of the HKTR. 


20.2 The FMIO team does not oversee the relations between the participants 
of the HKTR and their respective customers. It is the responsibility of 
the HKTR to identify, monitor and manage those risks arising from the 


relationship between the HKTR and its participants. 
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Annex 


CPMI-IOSCO Principles for Financial Market Infrastructures: Principles 
applicable to Trade Repositories 


Principle 1: Legal basis 


An FMI should have a well-founded, clear, transparent, and enforceable legal basis 


for each material aspect of its activities in all relevant jurisdictions. 


Principle 2: Governance 


An FMI should have governance arrangements that are clear and transparent, promote 
the safety and efficiency of the FMI, and support the stability of the broader financial 
system, other relevant public interest considerations, and the objectives of relevant 


stakeholders. 


Principle 3: Framework for the comprehensive management of risks 


An FMI should have a sound risk management framework for comprehensively 


managing legal, credit, liquidity, operational, and other risks. 


Principle 15: General business risk 


An FMI should identify, monitor, and manage its general business risk and hold 
sufficient liquid net assets funded by equity to cover potential general business losses 
so that it can continue operations and services as a going concern if those losses 
materialise. Further, liquid net assets should at all times be sufficient to ensure a 


recovery or orderly wind-down of critical operations and services. 


35 


Principle 17: Operational risk 

An FMI should identify the plausible sources of operational risk, both internal and 
external, and mitigate their impact through the use of appropriate systems, policies, 
procedures, and controls. Systems should be designed to ensure a high degree of 
security and operational reliability and should have adequate, scalable capacity. 
Business continuity management should aim for timely recovery of operations and 
fulfilment of the FMI’s obligations, including in the event of a wide-scale or major 
disruption. 


Principle 18: Access and participation requirements 


An FMI should have objective, risk-based, and publicly disclosed criteria for 


participation, which permit fair and open access. 


Principle 19: Tiered participation arrangements 


An FMI should identify, monitor, and manage the material risks to the FMI arising 


from tiered participation arrangements. 


Principle 20: FMI links 


An FMI that establishes a link with one or more FMIs should identify, monitor, and 


manage link-related risks. 


Principle 21: Efficiency and effectiveness 


An FMI should be efficient and effective in meeting the requirements of its 


participants and the markets it serves. 
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Principle 22: Communication procedures and standards 

An FMI should use, or at a minimum accommodate, relevant internationally accepted 
communication procedures and standards in order to facilitate efficient payment, 
clearing, settlement, and recording. 

Principle 23: Disclosure of rules, key procedures, and market data 

An FMI should have clear and comprehensive rules and procedures and should 
provide sufficient information to enable participants to have an accurate 
understanding of the risks, fees, and other material costs they incur by participating in 
the FMI. All relevant rules and key procedures should be publicly disclosed. 


Principle 24: Disclosure of market data by trade repositories 


A TR should provide timely and accurate data to relevant authorities and the public in 


line with their respective needs. 
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